Chris O'Connor is a senior consultant who blogs about SharePoint. He discusses the evolution of the SharePoint app model and client/server architectures. The new SharePoint 2013 app model uses client/server isolation with apps as the client and SharePoint as the server. It requires new thinking around security, code, and data using tools like Visual Studio, CSOM, REST, and OAuth.

1. Chris O’Connor
Senior Consultant (OBS)

2.  Chris O’Connor
 Senior Consultant – OBS (Melbourne)
 Blog : www.sharepointroot.com
 Twitter : @GrumpyWookie
 Father of three boys
 Weekend MAMIL
 Let’s go Mountain Biking !


3.  Where have we come from ?
 The new AppModel (SP2013) + Why ?
 New thinking for developers
 CSOM
 REST
 JSON
 ODATA
 OAUTH

4.  Client/Server
 Rich client + networked server
 N-tier
 Evolution of client/server (layers)
 ASP Classic -> ASP.NET
 MVC / MVVM
 SharePoint
 Features, Packages, Solutions
 ASP.NET + SharePoint API
 Office 365
 SharePoint 2013

5.  SharePoint 2013 + Office 365
 Architecture Pattern : AppModel
 SharePoint = Server
 App = Client
 It’s Client/Server !!

8. Everything is an app
Lists
Libraries
Calendars
Tasks
Issues
Announcements
EVERYTHING !

9. SharePoint 2003, 2007, 2010
Farm Solutions – WSP’s
Full Trust
2010 introduced Sandboxed Solutions
Isolation, but problematic/limited

10. To solve some problems :
 Code running on the SharePoint box
 Developer laziness
 RunWithElevatedPriveleges

11. SPSecurity.RunWithElevatedPrivileges(delegate()
{
using (SPSite site = new SPSite(web.Site.ID))
{
// do something
// call a method
});
}

12. SPSecurity.RunWithScissors(delegate()
{
using (SPSite site = new SPSite(web.Site.ID))
{
// do something
// call a method
});
}

13. Goal : Isolation
Benefits
 Multi-tenancy -> Office 365
 Ease of upgrade
 Easier to develop / update
Need to think “outside the box”

14. AppModel = Isolation
 Brings new challenges
Security
Code
Data

15. • CSOM
• REST
• JSON
• ODATA
• OAUTH
App
SharePoint 2013
- On-Premise
- Office 365
Security / Code / Data
- Authorisation + Permissions
- Structured API
- Data Contracts
ServerClient

17. Black Box thinking
SharePoint is “the server”
Developer will create “the client”
Apps for SharePoint

18.  Provider Hosted
 Auto-Hosted (Azure)
 SharePoint Hosted
 Client/Server “flavours”
 Visual Studio 2012 Project Types
App

20.  Visual Studio 2012
 Need to install project templates
 Microsoft Office Developer Tools for Visual Studio 2012
 Via Web Platform Installer (WebPI)
 http://tinyurl.com/platform-install
 SharePoint Designer 2013

23.  Napa
 Office 365 Development tools
 Add An App > SharePoint Store
 Browser based tools
 Works with ‘Developer Site’ on Office 365
 Office 365 Developer Site
 http://dev.office.com/
 Sign up today !

26. - Run Project
- Remove App
- Properties
- Open in Visual Studio
- Share Project
- Publish
- Quick Open

28. SharePoint App Model (2013)
 Isolation + multi-tenancy
 Brings new challenges
New application architectures
 Provider Hosted
 Azure Hosted
 SharePoint Hosted

29. New toolsets
 Visual Studio 2012
 Napa (Office 365)
 SharePoint Designer 2013
“Client Server” thinking
 Security
 Code
 Data

31.  Scope
 List
 WebSite
 Site Collection
 Tenancy
 AppPermissionRequest
 Read
 Write
 Manager
 Full Control

34. Code Security
 OAUTH – Security Protocol
 Between Apps & Services
 Without username/password
 Works in conjunction with :
 ACS – Access Control Services
 STS – Security Token Service

35. OAUTH
 Only for ‘cloud hosted’ apps
 Provider Hosted
 Azure Hosted
 Pass tokens via IFRAME (!??!)
 Need to do this way – avoid XSS

37. Provider-Hosted
 Any language / anything / anywhere
Azure-Hosted
 .NET languages – C# / VB.NET
SharePoint-Hosted
 JavaScript
 jQuery
 HTML

38.  CSOM
 REST
 No Server Object Model (SharePoint.dll)
 No code in the GAC

39.  Auto-Hosted -> Office 365
 Local application (IIS on laptop)
 Uses CSOM code
 TokenHelper
 ContextToken
 AccessToken
.

40.  URL based API
 OLD :
 /_layouts/listdata.svc/web
 NEW:
 /_api/web

41.  http://server/site/_api/web/lists
 http://server/site/_api/web/lists/getbytitle(‘name’)
 http://server/site/_api/web/lists('guid')/items?$select=Title,
Products
 http://server/site/_api/web/lists('guid')/items$filter=MyColu
mn eq 'Music’

43.  OData
 Open Data Specification
 CRUD operations via HTTP verbs
 GET (default) – retrieve data
 PUT – create new item
 POST – update item
 DELETE – remove item

44.  OData is built upon message formats
 AtomPub
 XML
 JSON
 JavaScript Object Notation
Open Standards

45. JavaScript Object Notation
{Key,Value} pairs
 Allows for objects, arrays + nested multiples

47.  SharePoint-Hosted -> Office 365
 JavaScript + jQuery
 REST – retrieve list of documents
 Data formatted & returned as JSON
 Display as HTML
 ContextToken
 Security
.

48.  Where have we come from ?
 The new AppModel (SP2013) + Why ?
 New thinking for developers
 CSOM
 REST
 JSON
 ODATA
 OAUTH
<< Security
<< Code
<< Data

49. Questions & Answers ??
 More Information ??
 Contact Me :
 Blog : www.sharepointroot.com
 Twitter : @GrumpyWookie


50. Thank you to our sponsors